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ABSTRACT 



A device that can be used to check the authenticity of 
time-accounting systems and devices, and notably of 
time-accounting devices for reckoning periods of park- 
ing regulated by rules. The system is constituted by a 
plurality of boxes, each held by a distinct user, each box 
comprising computation means that determine at least 
two secret codes, the changing from one secret code to 
another being done substantially at one and the same 
instant for all of boxes and secret codes being identical 
for all of boxes substantially at the same instant to en- 
able a checker to ascertain the authenticity of boxes, 
code-changing instant resulting from a secret computa- 
tion. 

13 Oaims, 3 Drawing Sheets 
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SECRET COMPUTATION 

INPUT:$ECRET KEY, YEAR, 

M0N1H, DAY OF MONTH, 
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UMIT MINUTE. 
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MONTH, DAY OF MONTH, 
CITY hT. 
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TIME-ACXX)UNnNG SYSTEM AND METHOD SUMMARY OF THE INVENTION 

COMPRISING MEANS FOR THE GENERATION More precisely, the main aim of the invention is to 

OF CODES AT INSTANTS COMPUTED BY A provide a device that can be used to prevent the use of 

SECRET ALGORITHM 5 regulated parking time-accounting devices that are spu- 
rious versions of those distributed by a recognized au- 

BACKGROUND OF THE INVENTION thority, or least make such use of spurious devices very 

1. Field of the Invention laborious and hence unprofitoble. 

The field of the invention is that of time-accounting ,n ^ complementary aim of the invention is to provide 

systems and devices, and notably that of time-account- ? f^'^P^ l^^J Aat can be used to check the 

ing devices for reckoning periods of parking regulated !?^^^ "^^^^"^ 

by rules. 2f"* 

More precisely, the present invention relates to a ^Tr.'^^^^t'^ ""^^^^ 

device that can be used to check the authenticity of a 15 'Z^hWnr t^^^ "T" ^ ^^'^^mtrng sys- 

device of this type * notably for the reckonmg of regulated parkmg 

Thcterm-time-accountingdevice-referetoanappa- ^Jl'^^TTJI .«>f ^^"^ ^y a plurality of 
r»f..c r>««.*;*«»-wi ft.- — J. * t?*^ ^^es, each held by a distmct user, each box comprising 

^^ble^n^^^^^^ ^!Lf^f?^V «^°^P«tation means that determine at least two'^^.crel 

S^^™ nf^l^^^^^ ^! .n one secret code to another 

wmdscreen of a vehicle and works m cooperation with 20 ^^^^ substantially at one and the same instant for 
a prepaid electronic ticket, for example a memory card. all of said boxes and said secret codes being identical for 
to decrement fee units, memorized in the card, accord- all of said boxes substantially at the same instant to 
ing o the parkmg time^ This type of device can be used enable a checker to ascertain the authenticity of said 
to elmiinate the need for fixed mdividual posts (of the boxes, said code^dxanging instant resulting from a se. 
pavement parking meter type) or posts used in common cret computation 

by many vehicles (of the type installed at the entrance Preferably, each of said boxes includes an indepen- 
to parking lots). The user automatically pays tiie park- dent integrated clock cooperating with said computing 
mg fees by mlroducmg a prepaid memory card into his means to generate said codes at a given date and time, 
box. The boxes are generally sold, loaned or given out ^ The presence of an internal clock such as this gives the 
on hire by local authorities or their agents who sell device of the invention a character of independence, 
parking units in the form of cards of a different type for According to a first embodiment, said computing 
each local authority. The validity of the parking can be means determine two codes for one and the same day, 
verified by means of a display device on which there the passage from one code to the other being done once 
appear various elements of information needed by the 35 a day at an hour and a minute that result from a secret 
checking staff, for example the number of the parking computation. 

zone selected by the user, a code identifying notably the According to a second embodiment, said computing 
type of card introduced by the user into the box and means determine two codes for each one-hour period, 
representing the town or city in which the parkmg is the changing from code to the other in the same one- 
being done and, as the case may be, an information 40 period being done at a minute that results from a 
element indicating a state of infringement of the rules, secret computation. 

and the number of fee unitis still available in the card. Advantageously, each box cooperates with an ele- 
The memories of the cards may be either rewritable or ™^^t containing consumable time units such as a mem- 
irreversibly written. ory card comprising an information clement that deter- 

2. Description of the Prior Art 45 niihes the period of time in which the changing of the 

A device such as this is described, for example, in the ^ P^^^^* ™s information is modifiable, 

French patent No. 87/06776 filed on behalf of the SO- enabling the payment card distributor to easily 

CIETE INTERNATIONAL POUR LINNOVA- modify the mode of operation of tiie boxes, for example 
TION. The device described is a box comprising means ^^^^^ *® change from a daily mode (two codes per 
to managing the changing of cards inserted into tiie box. 50 day) to an hourly mode (two codes per hour). 
It also includes means enabling tiie resetting of a clock . ^ccordrng to a preferred characteristic of the inven- 
internal to the box. This clock serves notably to make a ^^^^ computation is done on the basis of at 

regular count of the fee units and to take account of """"^ f ""/J^^ from the box and at 

periods during the day when it is not necessary to pay „ Si^^lSn"?) "^"^^ ^^'^^^ 

■for parkins. consumaoie luuis. 

A major preoccupation over this type of device re- J^J^ computotion is an opti- 

lates to 'the need to detect fraudulent tadividuals who "^^^T^f 

sSiuuSiJ'fntrf" Trf T^**^ st^rs^.^S'^^s^r^S'^t 
ffifSr^^s^i-i^srrrr^^^ " srjs-pr^Tah^tr '""^ 

peanmce as authentic boxes but contain only a display Preferably, said codes result from a computation that 

umt cooperatmg with appropriate electronic circuitry makes use of at leSst one information element belonging 

to simuhte a countmg of fee units. It would then be to the group comprising the current hour, a secret key. 
mpossible for a checker to detect the fraud without 65 the current date and a digital code characterizing the 

dismantlmg the spurious box. area of validity of the card inserted into the box 

An object of the present invention, notably, is to Advantageously, said computation means generate 

overcome this drawback of the prior art. said code-changing instant, one code preceding said 
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code-changing instant and one code following said 15 and 16 that can be used notably to program the tariff 
code-changing instant. zone 13 and to reset the current time in the box 10. The 

Accordmg to a prefeaed embodiment, said box com- microcircuit 18 of the 17 communicates with the elec- 
prises means noubly to display the current hour, said tronic circuitry of the box through reading/writing 
current code and/or the parking commencement time. 5 means that are not shown. 

It is then easy to check whether the device is authentic The secret code U appears on the display means 11 to 
or not. The display of the parking commencement time enable a checker to ascertain the authenticity of the box 
makes it possible to ascertain that the box+card system 10. The secret code 14 has the characteristic of being 
IS truly authentic (and that the user is in order) in the updated at least once a day, at a time unknown to the 
case of parking zones with limited parking periods. It is 10 user. Furthermore, this updating is done ahnost simulta- 
also advantageously possible to provide for the display ncously in aU the other boxes, the degree of simultaneity 
of the number of the parking zone selected by the user. depending on the variable extent to whicli their inte- 
when the system is initialized, to enable the checker to grated clocks are set to the exact time. Thus, if a fraudu- 
ascertain that the card introduced is being truly debited lent individual were to seek to create a spurious copy of 
by the box m accordance with the rules for the zone in 15 the external appearance of the box 10 in order to inte- 
which the vehicle is parked. grate electronic circuitry therein capable of displaying a 

Preferably, said box has means for being reset at the parking time limit on a display unit 11 without paying 
current time and time-lag means that systematically his parking fees (for example by placing a real payment 
delay the display of the current code on said display card 17 in relation with the box. in the same way as is 
means by several tens of seconds after a resetting at the 20 done with genuine boxes), he would also have to be 
current hour has been done, so as to discourage any ahnost constantly beside his vehicle to be able to display 
attempt at fraud. the new code, using any means (such as a keyboard on 

Advantageously, said current code appears on said the back of the box) as soon as he has gain knowledge of 
display means m the form of a hexadecimal number this new code, which he can do notably by looking at 
encoded on two digits. 25 the codes displayed on the genuine boxes placed in the 

Preferably, said codes and said code-changing instant other vehicles. This constraint therefore does not per- 
ore computed automatically at the commencement of mit this fraudulent person to go very far away from his 
the parking by the introduction of said element with vehicle since he would then risks penalties not only for 
consumable time units into said box or else automati- non-payment for his parking but also for his counterfeit- 
cally at the beginning of the each hour. The computing 30 ing activities. 

means are then activated periodically, and the device RGS. 2A and 2B show two modes of operation of 
does not requu-e any means to memorize a plurality of the invention, the fu^t mode consisting in making only 
. one change of code on one and the same day and the 

The device also relates to a time-accounting box that second mode consisting in making two changes of code 
forms part of a system as defined here above. 35 for each one-hour period of a day. 

BRIEF DESCRIPTION OF THE DRAWINGS ^^"^"^ ^^J^^ invention can work in two modes: 

the device of the invention generates two secret 

Uther features and advantages of the present inven- codes per day, the second code replacing the fu^t one at 
tion shall appear from the following description of a a precise instant of the day, resulting from a secret corn- 
preferred embodiment of the invention, given by way of 40 putation; 

a non-restrictive illustration, and from the appended the device generates two secret codes for each one- 
cV^^^' hour period of the day, the passage from one secret 

FIG, 1 shows a box according to the present inven- code to the other being done at a precise minute result- 

tion, working in cooperation with a memory card; ing from a secret computation. This mode of operation 

FIGS. 2A and 2B respectively show a first and sec- 45 has increased security since the secret code is modified 

ond mode of operation of the invention, the first mode several times a day. 

consisting in changing a code once in one and the same The first mode of operation is shown in FIG. 2A. The 
day. and the second mode consisting in changing a code parking period fixed by the rules starts, for example, at 
twice m each whole hour of a day; 9 a.m. and ends at 5 p.m. According to one embodiment 

FIGS. 3, 4, 5 and 6 are flow charts illustrating differ- 50 of the invention, the first code is displayed after the 
ent aspects of a preferred mode of operation of the insertion of the portable clement 17 into the box 10. In 
system for the generation and management of the secret the course of the day, at an instant ti resulting from a 
codes according to the invention. secret computation, the first secret code is replaced by 

DETAILED DESCRIPTION OF THE , ^ ^f!^ "^I^ ^^^^ ^ ^ displayed until the 

INVENTION parkmg period as laid down by the rules. 

Naturally, if the user inserts his card after the code- 

FIG. I shows a box accordmg to the present inven- changmg time, it is the second code that will be dis- 
tion cooperating with a memory card. played direcUy. The instant ti is preferably chosen to be 

A box 10 has a lateral slot 19 receiving a card 17 with precisely on the hour, but it may also correspond to a 
microcircuit 18. The box 10 has display means 11, con- 60 certain hour followed by a certain number of minutes 
stituted for example by a liquid crystal display screen. the accounting time unit being one minute. 
The display means 11 may give a constant display or a The second mode of operation is shown in FIG 2B 
cyclical scrolling display of the current time 12, the This mode of operation consists in changing the secret 
parking commencement tune, the parking zone 13 for code twice an hour, for example a first time precisely on 
which the units presented on the card 17 are debited and 65 the hour and a second time at an instant within the 
a code 14 resulting from the secret computation accord- corresponding one-hour period. Thus, in FIG 2B at 3 
mg to the mvention. The origin of this code 14 shall be p.m., the code becomes xi and remains unchanged until 
given m detail here below. The box 10 also has two keys the instant t2 when a new code X2 replaces the code xi 
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t2 resulting from a secret computation and being be- When this COMPUTATION sub-program is called 

tween 3 p.m. and 4 p.m. The code X2 then remains dis- up. it first of all carries out a test 45 of the mode of 

played on the display means until the precise instant operation of the system: hourly or daily, 

when the next hour strikes, i.e. until 4 p.m. At 4 p.m., a Should it be the hourly operating mode, the secret 

secret code X3 replaces the code X2 until an instant U 5 computation is done on the basis of the following data: 

when a code JU replaces the code xj. Since the paid a secret key. which is advantageously memorized in 

parkmg time accordmg to the rules ends at 5 p.m., the an EEPROM, during the manufacture or configuration 

code X4 may either remain displayed until the next of the box. Once stored in the EEPROM, this key is no 

mommg when a new code will replace it. or simply longer accessible from the exterior, 

^P^^^^?"^ the display. lo information on the current date, for example the year, 

FIGS. 3, 4, 5 and 6 are flow charts illustrating differ- month and day of the month; 

ent aspects of a preferred mode of operation of the a digital daU element representing the area of validity 

system for generating and managing secret codes ac- of the card, for example a digital code of a city or town- 

^iJll^^i^if^^ a digital code representing the current time; 

FIG. 3 illustrates the sequence of the operations per- 15 The secret algorithm uses these input data elements to 

formed by the central unit of the system, preferably give a digital code (for example on 16 bytes) which wUl 

every minute. be used to determine: 

At each end-of-minute interruption, the system the furst secret code of the one-hour period in 

checks whether a parking is in progress (31). If not (32), progress; 

the apparatus becomes dormant until the next end-of- 20 the second secret code of the one-hour period in 

minute interruption (30). The end-of-minute intemip- progress; 

tions are systematic once a card has been introduced the Umit minute for changing from the first code to 

*"*oi.^^ second code in the one-hour period in progress. 

Should there be a parking in progress, the system It is seen that, with this process, the secret computa- 

then cames out a test (33) on the nature of the code 25 tion verifies the following conditions: 

determination bit, i.e. whether the system works in it is prepared from information coming from the box 

hourly mode or in daily mode. (secret key, date, time, algorithm) and information com- 

In the event of an operation in hourly mode (for ing from the card (city or town code); 

example if the value of the bit=l), the system first it is specific to each city or town (since it takes ac- 

cames out a test to find out whether it is at the start of 30 count of the city or town code); 

an one-hour period (34), for example 3 p.m. If this is the it is specific to each day, and to each one-hour period, 

case, the system will proceed to a new computation 35 because both these parameters are taken into account 

of the two codes valid for the new one-hour period, as equally. 

well as the "limit minute" for changing from the fu-st SymmetricaUy, should the apparatus work in daily 

code to the second code (see FIG. 4), 35 mode, the secret computotion 47 works with the follow- 

The system then carries out a new test 36 to find out ing at input: 

whether it is at the code<hanging "limit minute". If it is the secret key; 

not at this position, the system simply updates (37) the the date (year, month, day of the month); 

value of the current time in the cyclical scrolling dis- the city or town code. 

play of the box, and goes into a dormant state 38 pend- 40 At output, it gives the first daily code, the second 

ing a new interruption, either for the end of a minute or daily code and the code-changing limit time. 

for the withdrawal of the card. HG. 5 Ulustrates the working of the system during 

By contrast, if the "limit minute" test 36 is positive, the insertion 50 of a valid card, 

the second code (post-limit code) of the one-hour per- After insertion 50, the system requires the selection of 

lod in progress replaces (39) the first code (pre-limit 45 a parking zone number, corresponding to a particular 

code) in the cyclical display of the box. The system then set of regulations governing parking in the city consid- 

carries out the step 37 for updating the current time and ered (namely, in the city that has issued the card in- 

the step 38 for going into the dormant state. serted into the box). This selection period is shown 

Should the operating mode test 33 indicate an opera- schematically by the repetitive test 51. 
tion in daUy mode, the system carries out a test 40 to 50 When the choice of a zone has been made, the system 
determine whether the current time corresponds to the calls up the secret computation program 52 (FIG. 4), 
beginning of an hour (this is identical to the test 34). If and then updates the cyclical display according to the 
the answer is no, there is a simple updating 37 of the results of the computation and depending on whether or 
current time displayed, then the system is placed in the not the computed limit has been exceeded (53). It then 
dormant state 38. 55 goes into dormant mode 54 until an end-of-minute inter- 
By contrast, if it is now the beginning of the one-hour ruption or a withdrawal of the card, 
period, the system makes a test 41 to fmd out if the As shown in FIG. 6, any withdrawal of the card 60 
curirent hour is a "limit hour" at which the second daily prompts an erasure 61 of the display and then an entry 
code should be substituted for the first daily code. De- into the dormant state 62 until a new card is uiserted 
pending on the results of the test, the first code then will 60 into the box or until an end-of-minute interruption, 
or wiU not be replaced (39) by the second code in the According to a preferred embodiment of the inven- 
cyclical display, before the updating (37) of the current tion, the codes and the code-changing mstant are each 
tiine displayed and the placing of the system in the determined on eight bits and the codes are displayed in 
dormant state (38), the form of hexadecimal numbers ranging from OOH to 

FIG. 4 gives a schematic view of the structure of the 65 FFH. The remaining 13 bytes are not used. 

COMPUTATION sub-program which prepares the In order to make the user responsible for the efficient 

secret codes and the code-changing periods on the basis functioning of his box, and to avoid the presence of 

of a secret algorithm. complex circuits used to compensate for the frequency 
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deviations of the quartz element used in the time base of means for computing and having at least two secret 
the device of the invention, these deviations being due codes, means for changing between the secret codes for 
to high-temperature variations behind the windscreen all boxes simultaneously, so that the boxes can be 
of a vehicle, it proves to be advanUgeous to allow the checked for authenticity. 

jKcr himself to set the current time and date on his box. 5 2. A system according to daim 1, wherrin each of 
Tniwe settings are done by means of two keys 15 and 16 said boxes includes an independent integrated dock 
(FIG. 1), which are pr«sed at the same tune as a card is cooperating with said computing means to generate said 
mserted mto the box 10. either key bemg pressed to codes at a given date and time. 

"a °' adjustment of the year, 3. a system according to claim 2, wherein said com- 

™;^^.iwii^vf . »° puting means determine two codes for one and the same 

TTus possibihty woiJd, however, enable an mdiscrete jay, the passage from one code to the other being done 
user to gain advance knowledge of the codes »>d the once a diy at an hour and a minute that itsult K 
code-changmg tunes by advancmg the time and/or date secret coinoutation 

is enough to set the time of the box, for example at ? 59 ^""^ ^ 

pmfo^certaindaytogainknowledgeofthe<»^^^^ « l^'^r'^ being done at a mmute that results 

this particular day at 2.59 p.m. and. kadditioraA«^ from a secret computation. _ . _ 
one minute, to gain knowledge of the code that wiU be 20 ^ system accordmg to claim 1. wherem each box 
displayed by the device from 3 p.m. onwards. Natu- «»?Perates with an element contaming consumable time 
rally, it will also be necessary to make a manual search. wherein sai(2 element comprises an information 

for example by means of a method of dichotomy, to ^l™^^ ^1 ^etenmncs the period of time in which the 
know the exact code<hanging instant which is between ang^g of the code has to take place, said information 
3 p.m. and 4 p.m. To discourage the rise of such a prac- 25 modifmble. 

tice, the invention proposes to avoid the display of a ^ ^^^^^^ accordmg to claim 1, wherein each box 

code immediately after the time has been set and after a cooP«rates with an element containing consumable time 
card has been inserted. Thus, after a parking payment wherein said secret computation is done on the 

card has been inserted into the box, time-lagging means clement of data coming from the box 

to set up a lag of some tens of seconds (for example 40s 30 l*^^ element of data coming from the elc- 

or even more than a minute) are activated and the code consumable units. 

corresponding to the day and time memorized appear ^ system according to claim 1, wherein said codes 

only at the end of the time-lagged period. Moreover, it f**"^^ * computation that makes use of at least one 
is necessary to withdraw the card and re-insert it into information element belonging to the group comprising 
the box in order to remodify the time. This is a painstak- 35 current date, the current hour, a digital code charac- 
ing operation and, furthermore, when the code appears, terizing the area of validity of the card inserted into the 
a parking credit unit is automatically debited from the box, and a secret key. 

card. In other words, such an attempt at fraud is costly. 8. A system according to claim 1, wherein said com- 
These various disadvantages and constraints are there- putation means generate said code-changing instant, 
fore aimed at discouraging any possible attempt at 40 one code preceding said code-changing instant and one 
fraud, which becomes unprofitable notably in view of code following said code-changing instant, 
the amount of time needed to obtain the codes and the A system according to claim 1, wherein said box 

code-changing times. comprises means notably to display the current hour 

Checks on validity of parking make it possible both to and/or said current code and/or the parking corn- 
detect possible imitations and spurious versions through 45 mencement time. 

the display of the code and to ascertain that a vehicle 10. A system according to claim 1, wherein said box 
has not infringed regulations by exceeding the parking has means for being reset at the current time and time- 
time limit or by having used up all its fee units. To lag means that systematically delay the display of the 
ascertain that the displayed code is truly the right one, current code on said display means by several tens of 
the checker may be equipped with a reference box 50 seconds after a resetting at the current hour has been 
working, for example, without a payment card or with done, so as to discourage any attempt at fraud, 
special cards. He may also compare the code dispkyed 11. A system according to claim 9, wherein said cur- 
by a box with those of other vehicles that have already rent code appears on said di^hiy means in the form of 
been checked. It is also possible to consider a use of a hexadecimal ntimber encoded on two digits, 
special boxes. Another possibility lies in comparing the 55 12. A system according to claim 5, wherein said codes 
codes displayed by the boxes with the codes in a oonfi- and said code-changing instant are computed automati- 
dential list in the possession of each checker. caUy at the commencement of the parking by the intro- 

The present invention can naturally be applied also in duction of said element with consumable time units into 
time-accounting devices for regulated parking where said box. 

the time cannot be modified by the user. 60 13. A system according to claim 1, wherein said codes 

What is claimed is: and said code-changing instant are computed automati- 

1. A time accounting system for regulating parking cally at the beginning of the each hour. 

time comprising a plurality of boxes each including « • • • * 

65 
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